nodejs - private REST API

Question

I have created a simple REST api for my application using node/ express. I am using AngularJS on the front end to serve pages to the user.

I would like to add functionality such that the API can only be accessed via my front-end and anyone should not be able to do a GET/POST request to my site and get the data?

What strategies can I use to achieve this?

Using authentication middleware? [Passport](http://passportjs.org/), for example. — raina77ow, Apr 30 '14 at 16:29
I couldn't quite understand how to integrate that into my solution as I am don't want to use password etc.. — dopplesoldner, Apr 30 '14 at 16:49
You don't have to use password etc.; there are different auth strategies. — raina77ow, Apr 30 '14 at 16:52
Ok did some reading, https://github.com/jaredhanson/passport-anonymous looks like this could help me. Am i correct? — dopplesoldner, Apr 30 '14 at 16:58
This thread may help you: http://stackoverflow.com/questions/15496915/how-to-implement-a-secure-rest-api-with-node-js — Carol Skelly, Apr 30 '14 at 17:53
Anyone can make exactly the same requests as a browser; you can make it a pain to do so automatically, but this fact will not change. — Aaron Dufour, Apr 30 '14 at 18:59

score 1 · Answer 1 · answered Apr 30 '14 at 17:19

1

HTTP request can be formatted and sent to sever by many other means beside a browser (curl for example), so any server always detecting correct source of a request is not guaranteed.

The basic method to protect an endpoint would be to use some kind of authentication. The requesting client must present something uniquely identifying it. API should provide clients a token after it proves itself authentic (via login etc), and all subsequent requests would be checked for this token.

answered Apr 30 '14 at 17:19

S.D.

29,290
3
79
130

If my client is a web application written in AngularJS, anyone can view the source and the token, how can I go around that? Sorry if my questions are amateurish. – dopplesoldner Apr 30 '14 at 17:30
@dopplesoldner That's why you encrypt it and store it in session storage of one user's browser. – S.D. Apr 30 '14 at 18:12

nodejs - private REST API

1 Answers1